[
https://issues.apache.org/jira/browse/FINERACT-2962?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Adam Saghy updated FINERACT-2962:
---------------------------------
Fix Version/s: 1.16.0
> Upgrade Spring Boot to 4.1.1 to fix CVE-2026-47884 and CVE-2026-47890
> ---------------------------------------------------------------------
>
> Key: FINERACT-2962
> URL: https://issues.apache.org/jira/browse/FINERACT-2962
> Project: Apache Fineract
> Issue Type: Task
> Reporter: Jose Alberto Hernandez
> Priority: Major
> Labels: security
> Fix For: 1.16.0
>
>
> *Background*
> {\{develop}} is on Spring Boot 4.1.0, which brings Spring Framework 7.0.8.
> Two CVEs published on 2026-08-20 affect \{{spring-webmvc}} 7.0.0 - 7.0.8 and
> are fixed in Spring Framework 7.0.9, which ships with Spring Boot 4.1.1:
> * *CVE-2026-47884*: RCE/SSRF via \{{XsltView}}
> ([https://spring.io/security/cve-2026-47884])
> * *CVE-2026-47890*: SSE stream corruption with view fragments
> ([https://spring.io/security/cve-2026-47890])
> *Problem / Motivation*
> Container scanners (e.g. Trivy, which uses the GHSA score) flag both CVEs as
> CRITICAL (CVSS 9.8). Spring rates them 5.8 and 2.6. Images built from
> \{{develop}} therefore fail any CVSS >= 9 gate.
> Fineract does not appear to be exploitable: \{{spring-webmvc}} is on the
> classpath (\{{spring-boot-starter-webmvc}}, springdoc) and Spring MVC serves
> the Thymeleaf login page (\{{LoginController}}), but the codebase has no use
> of \{{XsltView}}, \{{SseEmitter}}, \{{FragmentsRendering}} or
> \{{ModelAndView}}, which are the preconditions of both CVEs. The REST API
> itself is served by Jersey. This is a code search, not an exploitability
> analysis.
> The upgrade is not a version bump only. Spring Boot 4.1.1 changed the
> signature of \{{JpaBaseConfiguration#entityManagerFactoryBuilder}}: the last
> parameter \{{Map<String, AsyncTaskExecutor> taskExecutors}} was replaced by
> \{{ListableBeanFactory beanFactory}}. \{{JPAConfig}} overrides that method,
> so \{{develop}} does not compile against 4.1.1 until the override is adapted.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
